Title: [245921] branches/safari-607-branch
- Revision
- 245921
- Author
- [email protected]
- Date
- 2019-05-30 17:30:01 -0700 (Thu, 30 May 2019)
Log Message
Cherry-pick r245300. rdar://problem/51264763
Do not try to issue repaint while the render tree is being destroyed.
https://bugs.webkit.org/show_bug.cgi?id=197461
<rdar://problem/50368992>
Reviewed by Simon Fraser.
Source/WebCore:
Test: http/tests/svg/crash-on-reload-with-filter.html
We don't need to compute repaint rects when the render tree is getting torn down. We'll issue a full repaint at some point.
Also during full render tree destruction the inline tree state is undefined. We should avoid accessing it.
* rendering/svg/RenderSVGResourceContainer.cpp:
(WebCore::RenderSVGResourceContainer::markAllClientLayersForInvalidation):
LayoutTests:
* http/tests/svg/crash-on-reload-with-filter-expected.txt: Added.
* http/tests/svg/crash-on-reload-with-filter.html: Added.
* http/tests/svg/resources/finishTest.html: Added.
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@245300 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Modified Paths
Added Paths
Diff
Modified: branches/safari-607-branch/LayoutTests/ChangeLog (245920 => 245921)
--- branches/safari-607-branch/LayoutTests/ChangeLog 2019-05-31 00:29:58 UTC (rev 245920)
+++ branches/safari-607-branch/LayoutTests/ChangeLog 2019-05-31 00:30:01 UTC (rev 245921)
@@ -1,5 +1,45 @@
2019-05-30 Kocsen Chung <[email protected]>
+ Cherry-pick r245300. rdar://problem/51264763
+
+ Do not try to issue repaint while the render tree is being destroyed.
+ https://bugs.webkit.org/show_bug.cgi?id=197461
+ <rdar://problem/50368992>
+
+ Reviewed by Simon Fraser.
+
+ Source/WebCore:
+
+ Test: http/tests/svg/crash-on-reload-with-filter.html
+
+ We don't need to compute repaint rects when the render tree is getting torn down. We'll issue a full repaint at some point.
+ Also during full render tree destruction the inline tree state is undefined. We should avoid accessing it.
+
+ * rendering/svg/RenderSVGResourceContainer.cpp:
+ (WebCore::RenderSVGResourceContainer::markAllClientLayersForInvalidation):
+
+ LayoutTests:
+
+ * http/tests/svg/crash-on-reload-with-filter-expected.txt: Added.
+ * http/tests/svg/crash-on-reload-with-filter.html: Added.
+ * http/tests/svg/resources/finishTest.html: Added.
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@245300 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2019-05-14 Zalan Bujtas <[email protected]>
+
+ Do not try to issue repaint while the render tree is being destroyed.
+ https://bugs.webkit.org/show_bug.cgi?id=197461
+ <rdar://problem/50368992>
+
+ Reviewed by Simon Fraser.
+
+ * http/tests/svg/crash-on-reload-with-filter-expected.txt: Added.
+ * http/tests/svg/crash-on-reload-with-filter.html: Added.
+ * http/tests/svg/resources/finishTest.html: Added.
+
+2019-05-30 Kocsen Chung <[email protected]>
+
Cherry-pick r244950. rdar://problem/51265731
TypedArrays should not store properties that are canonical numeric indices
Added: branches/safari-607-branch/LayoutTests/http/tests/svg/crash-on-reload-with-filter-expected.txt (0 => 245921)
--- branches/safari-607-branch/LayoutTests/http/tests/svg/crash-on-reload-with-filter-expected.txt (rev 0)
+++ branches/safari-607-branch/LayoutTests/http/tests/svg/crash-on-reload-with-filter-expected.txt 2019-05-31 00:30:01 UTC (rev 245921)
@@ -0,0 +1 @@
+Pass if no crash or assert.
Added: branches/safari-607-branch/LayoutTests/http/tests/svg/crash-on-reload-with-filter.html (0 => 245921)
--- branches/safari-607-branch/LayoutTests/http/tests/svg/crash-on-reload-with-filter.html (rev 0)
+++ branches/safari-607-branch/LayoutTests/http/tests/svg/crash-on-reload-with-filter.html 2019-05-31 00:30:01 UTC (rev 245921)
@@ -0,0 +1,11 @@
+<div style="display: inline-block;"></div>
+<svg><filter id="svgfilter"><feOffset/></filter></svg>
+<span style="-webkit-text-emphasis: '-';"></span>
+<video style="filter: url(#svgfilter);"></video>
+<script>
+document.body.offsetHeight;
+location = "resources/finishTest.html";
+
+if (window.testRunner)
+ testRunner.waitUntilDone();
+</script>
Added: branches/safari-607-branch/LayoutTests/http/tests/svg/resources/finishTest.html (0 => 245921)
--- branches/safari-607-branch/LayoutTests/http/tests/svg/resources/finishTest.html (rev 0)
+++ branches/safari-607-branch/LayoutTests/http/tests/svg/resources/finishTest.html 2019-05-31 00:30:01 UTC (rev 245921)
@@ -0,0 +1,6 @@
+Pass if no crash or assert.<script>
+if (window.testRunner) {
+ testRunner.dumpAsText();
+ testRunner.notifyDone();
+}
+</script>
Modified: branches/safari-607-branch/Source/WebCore/ChangeLog (245920 => 245921)
--- branches/safari-607-branch/Source/WebCore/ChangeLog 2019-05-31 00:29:58 UTC (rev 245920)
+++ branches/safari-607-branch/Source/WebCore/ChangeLog 2019-05-31 00:30:01 UTC (rev 245921)
@@ -1,5 +1,49 @@
2019-05-30 Kocsen Chung <[email protected]>
+ Cherry-pick r245300. rdar://problem/51264763
+
+ Do not try to issue repaint while the render tree is being destroyed.
+ https://bugs.webkit.org/show_bug.cgi?id=197461
+ <rdar://problem/50368992>
+
+ Reviewed by Simon Fraser.
+
+ Source/WebCore:
+
+ Test: http/tests/svg/crash-on-reload-with-filter.html
+
+ We don't need to compute repaint rects when the render tree is getting torn down. We'll issue a full repaint at some point.
+ Also during full render tree destruction the inline tree state is undefined. We should avoid accessing it.
+
+ * rendering/svg/RenderSVGResourceContainer.cpp:
+ (WebCore::RenderSVGResourceContainer::markAllClientLayersForInvalidation):
+
+ LayoutTests:
+
+ * http/tests/svg/crash-on-reload-with-filter-expected.txt: Added.
+ * http/tests/svg/crash-on-reload-with-filter.html: Added.
+ * http/tests/svg/resources/finishTest.html: Added.
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@245300 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2019-05-14 Zalan Bujtas <[email protected]>
+
+ Do not try to issue repaint while the render tree is being destroyed.
+ https://bugs.webkit.org/show_bug.cgi?id=197461
+ <rdar://problem/50368992>
+
+ Reviewed by Simon Fraser.
+
+ Test: http/tests/svg/crash-on-reload-with-filter.html
+
+ We don't need to compute repaint rects when the render tree is getting torn down. We'll issue a full repaint at some point.
+ Also during full render tree destruction the inline tree state is undefined. We should avoid accessing it.
+
+ * rendering/svg/RenderSVGResourceContainer.cpp:
+ (WebCore::RenderSVGResourceContainer::markAllClientLayersForInvalidation):
+
+2019-05-30 Kocsen Chung <[email protected]>
+
Cherry-pick r244892. rdar://problem/50753927
Setting a frame's src to a _javascript_ URL should not run it synchronously
Modified: branches/safari-607-branch/Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp (245920 => 245921)
--- branches/safari-607-branch/Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp 2019-05-31 00:29:58 UTC (rev 245920)
+++ branches/safari-607-branch/Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp 2019-05-31 00:30:01 UTC (rev 245921)
@@ -122,6 +122,10 @@
void RenderSVGResourceContainer::markAllClientLayersForInvalidation()
{
+ if (m_clientLayers.isEmpty())
+ return;
+ if ((*m_clientLayers.begin())->renderer().renderTreeBeingDestroyed())
+ return;
for (auto* clientLayer : m_clientLayers)
clientLayer->filterNeedsRepaint();
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
